sfx2/source/sidebar/ControllerItem.cxx |    7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

New commits:
commit ed6735a84b0bdf8b8f37d5d6c70a076400ddc1b8
Author:     Caolán McNamara <caolan.mcnam...@collabora.com>
AuthorDate: Mon May 12 09:15:53 2025 +0100
Commit:     Miklos Vajna <vmik...@collabora.com>
CommitDate: Mon May 12 15:47:48 2025 +0200

    null deref seen on ControllerItem::ReceiverNotifyItemUpdate
    
     #0  CntUInt16Item::SetValue (nTheValue=8, this=0x0) at 
include/svl/cintitem.hxx:91
     #1  sfx2::sidebar::ControllerItem::ReceiverNotifyItemUpdate 
(this=0x250f5628, nSID=<optimized out>, eState=SfxItemState::UNKNOWN,
         pState=0x792a379165d0 <(anonymous namespace)::aDisabledItem>)
         at sfx2/source/sidebar/ControllerItem.cxx:56
     #2  0x0000792a33a04284 in SfxStateCache::SetState_Impl (this=0x25170250, 
eState=SfxItemState::UNKNOWN, pState=0x792a379165d0 <(anonymous 
namespace)::aDisabledItem>,
         bMaybeDirty=<optimized out>) at sfx2/source/control/statcach.cxx:428
     #3  0x0000792a33a042fc in SfxStateCache::SetState (this=<optimized out>, 
eState=<optimized out>, pState=<optimized out>, bMaybeDirty=<optimized out>)
         at sfx2/source/control/statcach.cxx:335
     #4  0x0000792a339e20e4 in SfxBindings::UpdateControllers_Impl (rFound=..., 
pItem=<optimized out>, eState=eState@entry=SfxItemState::DEFAULT)
         at sfx2/source/control/bindings.cxx:1218
     #5  0x0000792a339e5437 in SfxBindings::Update_Impl (this=<optimized out>, 
rCache=...)
         at sfx2/source/control/bindings.cxx:279
     #6  0x0000792a339e5e11 in SfxBindings::NextJob_Impl 
(this=this@entry=0x262f52c0, pTimer=pTimer@entry=0x26104cc8)
         at sfx2/source/control/bindings.cxx:1281
     #7  0x0000792a339e6020 in SfxBindings::NextJob (this=0x262f52c0, 
pTimer=0x26104cc8)
         at sfx2/source/control/bindings.cxx:1226
     #8  0x0000792a350adadb in Scheduler::CallbackTaskScheduling ()
         at vcl/source/app/scheduler.cxx:579
     #9  0x0000792a3526d9eb in SalTimer::CallCallback (this=<optimized out>)
    
    (gdb) print *pState
    $5 = {_vptr.SfxPoolItem = 0x792a37591020 <vtable for (anonymous 
namespace)::DisabledItem+16>, m_nRefCount = 0, m_nWhich = 0, m_bStaticDefault = 
true,
      m_bDynamicDefault = false, m_bIsSetItem = false, m_bShareable = true, 
m_bNameOrIndex = false}
    
    DisabledItem isn't cloneable
    
    Change-Id: Ic9a9134f25b4a66485bd43991451b2841cd3a9f6
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/185199
    Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoff...@gmail.com>
    Reviewed-by: Miklos Vajna <vmik...@collabora.com>

diff --git a/sfx2/source/sidebar/ControllerItem.cxx 
b/sfx2/source/sidebar/ControllerItem.cxx
index 313cf1c49566..987e95cd0797 100644
--- a/sfx2/source/sidebar/ControllerItem.cxx
+++ b/sfx2/source/sidebar/ControllerItem.cxx
@@ -44,10 +44,15 @@ ControllerItem::~ControllerItem()
     dispose();
 }
 
+static bool IsCloneable(const SfxPoolItem* pState)
+{
+    return pState && !IsInvalidItem(pState) && !IsDisabledItem(pState);
+}
+
 void ControllerItem::ReceiverNotifyItemUpdate(sal_uInt16 nSID, SfxItemState 
eState,
                                               const SfxPoolItem* pState)
 {
-    if (nSID == SID_ATTR_METRIC && pState && 
comphelper::LibreOfficeKit::isActive())
+    if (nSID == SID_ATTR_METRIC && IsCloneable(pState) && 
comphelper::LibreOfficeKit::isActive())
     {
         std::unique_ptr<SfxPoolItem> xClose(pState->Clone());
         MeasurementSystem eSystem

Reply via email to